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Abstract 

In this paper, we first present a new secondary construction of bent 
functions (building new bent functions from two already defined ones) . 
Furthermore, we apply the construction using as initial functions some 
specific bent functions and then provide several concrete constructions 
of bent functions. The second part of the paper is devoted to the 
constructions of resilient functions. We give a generalization of the 
indirect sum construction for constructing resilient functions with high 
nonlincarity. In addition, we modify the generalized construction to 
ensure a high nonlinearity of the constructed function. 

Keywords : Boolean function, bent function, resilient function, high 
nonlinearity. 

1 Introduction 

Bent functions were introduced by Rothaus in 1976 as an interesting combi- 
natorial object with the important property of having optimal nonlinearity 
|36j . Since bent functions have many applications in sequence design, cryp- 
tography and algebraic coding [26j E3] , they have been extensively studied 
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during the thirty last years O HI [131 EH GSE 1231 EEJ E] ■ In terms of sequence 
design, several binary bent sequences were constructed by using the bent 
functions [32, 33J. Binary bent sequences can be good candidates for many 
commutation systems such as code-division multiple-access systems, radar 
systems, and synchronization systems in that they have optimal correlation 
and balance property |25 [ I32 [ [33] . In addition, bent functions can also be 
used to construct highly nonlinear balanced functions |19j . 

With regard to constructions of bent functions, there are two kinds 
of constructions: primary constructions (designing functions without us- 
ing known ones) and secondary constructions. The primary constructions 
mainly include the Maiorana-McFarland (M-M) class [18] , the partial spreads 
(PS) class [18] and Dobbertin gave a construction of a class of bent functions 
which leads to some elements of M-M class and of PS class as extremal cases 
[19] . The secondary constructions mainly include direct sum construction 
[18] . Rothaus' construction [36], indirect sum construction [9]. Moreover, 
there are some constructions of bent functions proposed in [3j [5j [H [161 [2l] . 
However, although many concrete constructions of bent functions have been 
discovered, the general structure of bent functions is still unclear. In par- 
ticular a complete classification of bent functions seems hopeless today. 

Resilient functions have important applications in the nonlinear com- 
biner model of stream cipher [TJ [391 H2]- Over the last decades, much at- 
tention was paid to the construction of highly nonlinear Boolean functions 
in the cryptographic literature [3 [221 EH [371 113 SSI SH US]- In terms of 
constructions of resilient functions, there are also two kinds of constructions 
which are primary constructions and secondary constructions. The primary 
constructions mainly include Maiorana-McFarland's construction pQ, gen- 
eralizations of Maiorana-McFarland's construction [TJED]) Dobbertin's con- 
struction |19[ [38] and other constructions [211 H6] . In addition, the simple 
secondary constructions mainly include direct sum of functions [39] , Siegen- 
thaler's construction |39j . Tarannikov's elementary construction [40j, indi- 
rect sum of functions [9] and constructions without extension of the number 
of variables [11]. Many highly nonlinear Boolean functions can be con- 
structed by using the above constructions. 

In this paper, we first present a new secondary construction of bent func- 
tions. We show how to construct an (n + m — 2)-variable bent function from 
two known bent functions in n variables and in m variables respectively. 
Furthermore, by selecting the known bent functions as the initial functions 
of the new secondary construction, we can provide several concrete construc- 
tions of bent functions which include primary constructions (Corollary [2] and 
Corollary [5]) and secondary constructions (Corollary [3] and Corollary [J]) . In 
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the second part of the paper, we present a generalization of the indirect 
sum construction for constructing resilient functions with high nonlinearity. 
On this basis, we provide another two secondary constructions of resilient 
functions. It is shown that many new (n + m)-variable functions with non- 
linearity strictly more than 2 n+m ~ 1 — 2L( n+m )/ 2 J can be easily obtained by 
using these secondary constructions, where [(n + m)/2\ denotes the largest 
integer not exceeding (n + m)/2. 

The rest of the paper is organized as follows. Section [2] introduces basic 
definitions and cryptographic criteria relevant for Boolean functions. In 
Section [3l we present a method for constructing bent functions. In Section [H 
we provide a generalization of the indirect sum construction for constructing 
resilient functions. At last, some conclusions are given in Section [5l 

2 Preliminaries 

In the remainder of this paper, we denote the additions and multiple sums 
over the finite field F2 by © and Q). Let FJ? be the n-dimensional vector 
space over F2, and B n the set of all n- variable Boolean functions from F?> 
to F2. A basic representation of a Boolean function f(x\, . . . ,x n ) is by the 
output column of its truth-table, i.e., a binary string of length 2 n , 

[/(0,... ,0,0,0),... ,/(l,...,l,l,0),/(l,... ,1,1,1)]. 

The Hamming weight wt(/) of a Boolean function / € B n is the weight 
of the above binary string. We say a Boolean function / is balanced if its 
Hamming weight equals 2 n_1 . The Hamming distance d(f,g) between two 
Boolean functions / and g is the Hamming weight of their difference / © g. 

Any Boolean function has a unique representation as a multivariate poly- 
nomial over F2, called the algebraic normal form (ANF): 

/(xi,...,x n ) = (J) a/JJx; 

IC{l,2,...,n} lei 

where a/ € F2, and the terms Yl ie j x\ are called monomials. The algebraic 
degree deg(/) of a Boolean function / equals the maximum degree of those 
monomials whose coefficients are nonzero in its ANF. A Boolean function 
is affine if it has algebraic degree at most 1. The set of all n- variable affine 
functions is denoted by A n . An n- variable affine function with constant term 
is a linear function, and can be represented as oj ■ x = uixi © ... © ui n x n 
where ui = . . . , uj n ) S F^, x = (xi, . . . , x n ) £ F2 . 
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The nonlinearity of / E B n is its distance to the set of all re-variable 
affine functions, i.e., 

Nf = min d(f,g). 

Boolean functions used in cryptographic systems must have high nonlinear- 
ity to withstand linear and fast correlation attacks [2]. 

The Walsh transform of / G B n is the integer valued function over F2 
defined as 

W f (u) = (-l) f{x) ®"- x . 

In terms of Walsh spectrum, the nonlinearity of / is given by 

Nf = 2 n ~ 1 - -max|Wffw)|. 

Parseval's equation [26] states that X^eF™^ fi 00 )) 2 = ^ 2n and implies 
that 

N f < 2 n - 1 - 2 n/2 - 1 . 

Definition 1 JTty, [Sb Tj A Boolean function f E B n is called bent ifWt(a) = 
±2 n / 2 (that is, N f = 2"" 1 - 2 n / 2 ~ l ) for every a G F£ (n even). 

If / G B n is bent, then the dual function / of /, defined on F?? by: 

W f (u) = 2™/ 2 (-l)^) 

is also bent and its own dual is / itself. 

Definition 2 J^7| / Let f G B n . If there exists an even integer r , < r < n, 
such that || {<jj\Wf{uj) 7^ 0, G Fg} ||= 2 r , where \\ ■ \\ denotes the size of 
a set, and (Wf{uj)) 2 equals 2 2n ~ r or 0, for every uj G F2, then f is called 
an rth-order plateaued function in n variables. If f is a 2\^}th- order 
plateaued function in n variables, where |~n/2] denotes the smallest integer 
exceeding n/2, then f is also called a semi-bent function. 

A Boolean function / G B n is said to be correlation-immune of order 
r (1 < r < n), if the output of / and any r input variables are statis- 
tically independent. Balanced rth-order correlation immune functions are 
called r-resilient functions. The set of rth-order correlation immune (resp. 
r-resilient) Boolean functions is included in that of (r — l)th-order corre- 
lation immune (resp. (r — l)-resilient) Boolean functions. The correlation 
immunity (resp. resiliency) can also be characterized by using the Walsh 
transform domain |42|: 
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Lemma 1 Let f € B n , then f is rth-order correlation immune (resp. r- 
resilient) if and only if its Walsh transform satisfies Wf(u>) = 0, for all 
u) € F£ such that 1 <wt(w) < r (resp. <wt(w) <r). 

Siegenthaler's Inequality [39J states that any rth-order correlation immune 
function has degree at most n — r, that r-resilient function (0 < r < n — 1) 
has degree smaller than or equal n — r — 1 and that any (n — l)-resilient 
function has algebraic degree 1. Sarkar and Maitra [37J have shown that 
the nonlinearity of any m-resilient function (m < n — 2) is divisible by 2 m+1 
and is therefore upper bounded by 2 n_1 — 2 m+1 . If a function achieves this 
bound (independently obtained by Tarannikov [40] and Zheng and Zhang 
[4*8]). then it also achieves Siegenthaler's bound (cf. [10]). More precisely, if 
/ is m-resilient and has algebraic degree d, then its nonlinearity is divisible 
by 2 m+1+ L Ii ^r^J (see [SHU]) and can therefore be equal to 2™" 1 -2 m+1 only 
if d = n — m — 1. Moreover, if an m-resilient function achieves nonlinearity 
2 n— 1 _ 2 m + 1 i then the Walsh spectrum of the function has then three values 
(such functions are often called "plateaued" or "three- valued" ) . We shall 
say that an m-resilient function achieves the best possible nonlinearity if 
its nonlinearity equals 2 n_1 — 2 m+1 . If 2 n_1 — 2 m+1 is greater than the 
best possible nonlinearity of all balanced functions (and in particular if it 
is greater than the best possible nonlinearity 2 n_1 — 2 n / 2-1 of all Boolean 
functions) then, obviously, a better bound exists. In the case n is even, 
the best possible nonlinearity of all balanced functions being smaller than 

2 n-l _ 2 n/2-l ) we have that Nf < 2 n-l _ 2 n/2-l _ 2 m+l for every m _ res ili en t 

function / with m < n/2 — 2. In the case n is odd, Nf is smaller than or 
equal to the highest multiple of 2 m+1 , which is less than or equal to the 
best possible nonlinearity of all Boolean functions. In the sequel, we shall 
call "Sarkar et al.'s bounds" all these bounds. We shall also extend the 
definitions of correlation-immune and resilient functions, so that our results 
are as general as possible: by convention, we shall say that any Boolean 
function is Oth-order correlation immune and (—1) -resilient and that any 
balanced function is 0-resilient. 

We call (n, m)-functions the functions from FJ? to F?p. Such function 
F being given, the Boolean functions fi, ■ ■ ■ , f m defined, at every i £ F™, 
by F{x) = (/i,...,/ m ), are called the coordinate functions of F. Obvi- 
ously, these functions include the (single-output) Boolean functions which 
correspond to the case m = 1. Furthermore, for m = n, the function 
F(x) = , fn) is called a Boolean permutation if F(x) is a bijective 

mapping from F?? to FJ;. 

The original Maiorana-McFarland's (M-M) class of bent functions [30] 
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is the set of all the (bent) Boolean functions on ¥ 2 n = {(x,y),x,y S ¥ 2 } of 
the form: 

f(x,y) = x ■ <j>{y) ®g{y) 
where 4>{y) = {4>\{y) , 4> 2 {y) , ■ ■ ■ > 0nG/)) is an y permutation on ¥ 2 and g € B n . 

Lemma 2 For x £ ¥ 2 ,y £ ¥ 2 , let <j)i{y), 1 < i < n, be an n-variable 
Boolean function, and g(y) be any n-variable Boolean function. A In- 
variable Boolean function f{x,y) = x ■ <f>(y) © g(y) = 0™ =1 4>i(yi, ■ ■ ■ ,y n )xi@ 
g(yi, ■ ■ ■ , y n ) is a bent function if and only if 

4>{y) = (0i(2/)>02(y),...,0n(y)) 

is a Boolean permutation. 

This property comes directly from the fact that any restriction of / 
obtained by fixing y is affine. We shall say that the coordinates of x are 
"affine" . In the next section, we shall use such functions in a different - but 
equivalent - form: n will be the global number of variables (instead of 2n) 
and the "affine" variables will be xi, . . . , x n /2, that is, the functions will have 

the form f(xi,.. .,x n ) = 0™^ 4>i{x n/2+ i, ■ ■ ■ , x n ) Xi ® g(x n/2+ i , . . . ,x n ). 

3 Secondary constructions of bent functions 

In this section, we present secondary constructions of bent functions. Before 
that, we first recall the concept of complementary plateaued functions. It 
will play an important role in the following constructions. 

Definition 3 Let p be a positive odd number and gi,g 2 € B p . Then 
gi and g 2 are said to be complementary (p — l)th-order plateaued functions 
in p variables if they are p-variable (p — l)th-order plateaued functions, and 
satisfy the property that W gi (uS) = if and only if W 92 (uj) ^ 0. 

Lemma 3 J^7| / Let n be a positive even number and x = (x\,x 2 , ■ ■ ■ , x n ) 6 
¥ 2 . Thenf(x) is bent if and only if the two functions, f{x\, ... ,Xj—i, 0,x 3 -+i, 
. . . , x n ) and f(x\, . . . , Xj—i, 1, Xj+i, . . . , x n ) are complementary (n — 2)th- 
order plateaued functions in n — 1 variables, where j = 1,2, ... ,n. 

In [9], Carlet designed a secondary construction of bent functions, often 
called the indirect sum: 
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Corollary 1 JIJ [7j|/ Let x € Fjj, 2/ G F™. Lei /i and /2 be two n-variable 
bent functions (n even) and let gi and g^ be two m-variable bent functions 
(m even). Define 

h(x,y) = h(x) © gi{y) © (/i © / 2 )(x) ( gi © <? 2 )(y). 

TTien /i is bent and its dual is obtained from /i,/2,Pi and <?2 °2/ same 
formula as h is obtained from fi,fa,gi and g2- 

This above secondary construction was altered into constructions of re- 
silient functions, see [9], which includes as a particular case the well- know 
direct sum [39], that we recall: for x € F?J and y € F™, let f(x) be an 
n-variable i-resilient function {t > 0) and g(y) be an m-variable /c-resilient 
function (k > 0), then the function 

h{x,y) = f{x)®g{y) 

is a (i + + l)-resilient function in n + m variables. The nonlinearity of 
y) is equal to 2"^ + 2 m N f - 2N f N g . 

In the present paper, we first modify the indirect sum into a new con- 
struction of bent functions: 

Construction 1 Let n and m be two positive even numbers. For X = 
(a?!, • ■ • , x n ) £ F?j andY = (y 1} . . . ,y m ) € F^, x = (x 1 , . . . , x p+1 , . . . , x n ) € 
F2~\y = (yi,---, y p -i,y p+ i, ■ ■ ■ ,y m ) e Fg 1-1 , let f(X) be an n-variable 
bent function and g(Y) an m-variable bent function. We consider the re- 
strictions of f equal to fo(%) = f(xi, . . . , sc^-ii 0, x p+ i, 
...,x n ), fi(x) = f(xi, . . . ,a; M _i, . . . ,x n ) and of g equal to g (y) = 

g(yi, ■ ■ - ,y P -i,o,yp+u ■ ■ -,ym), gi(y) = g(yi,- ■ -,y P -i, i,y P +i,-- . ,y m ), where 

fj, E {1, 2, ... , n}, p & {1,2, ... , m} and we define: 

h(x, y) = f (x) © g (y) © (/ © fi)(x) (g © gi )(y). 
This construction indeed provides bent functions: 

Theorem 1 Let f(X) € B n ,g(Y) € B m and h{x,y) € -B n +m-2 be defined 
as in Construction^ Then h is a bent function inn + m — 2 variables. Fur- 
ther, the dual of h is obtained from fo(x) = f(x±, . . . , x p -\, 0, x p+ i, . . . ,x n ), 
fi(x) = f(xi, . . . ,x p -i, 1, x p+1 ,...,x n ), go(y) =g(y 1 ,...,y p - 1 ,0,y p+1 ,..., 
y m ) and gj(y) = g(yi, . . . ,y p -%, l,y P +i, ■ ■ ■ ,y m ), by the same formula as h 
is obtained from /o, fi,go and g\. 
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Proof. According to Definition [H the bentness of h(x,y) will be proved if 
we can show that Wh(a, b) = ±2( n + m_2 )/ 2 for every a = (ax, . . . , a M _i, a^+i, . . . , a n ) € 
Fg" 1 and 6 = (61, ... , b p -x, b p+1 , ...,b m ) 6 F™" 1 . As shown in [9j for all 
Boolean functions, we have: 



w h (a,b)= Y E (-i) ft (*.v)©«-*ffi 



b-y 



xeF™- 1 yew™' 1 



Y Y (-l)/«( :c )® a ' :r (-l)S , o(2/)© 6 -2/ 



2/GFJ 1 



_|_ ^ ^ (_l\Mx)®a-xr i\gi{y)@b-y 



/o®/i=i 

--w go (b) Y (-i) fo{x)(Ba - x +w gi (b) y (-i) f °w® a - x (i) 



/o©/i=o /o®/i=i 



=w 90 (b)Y (-i)/oW^ ( 1+ (- 1 ) ( f e/l)W ' 

+W ffl (6)E (-l)AW^ ^-'-i)'^ ' 
=|Wio(6) [Wyb(a) + W A (a)]+ |W^(6) [W /o (a) - W fl (a)} . 

Prom Lemma O /o and fx are complementary (n — 2)th-order plateaued 
functions in n — 1 variables, 50 an d Qx are complementary (m — 2)th-order 
plateaued functions inm-1 variables. According to Definition [3] and Defini- 
tional it follows that W h (a,b) = ±2( n + m ~ 2 )/ 2 for everya eF™" 1 ^ G F™" 1 . 

Next, we show that the dual of h is obtained from /o, fx, go and ~g~\. We 
have: 

Wf{ax, ■ ■ ■j^fj.-x, 0, a^+i, . . . , a n ) 

= 2f (_l)/o(a) 

— ^ (_l)/o(a;)©a^ _|_ ^ (_;Q/l(ai)©a-a; ^2) 

_ w n— 1 rlB n-l 

= W f0 {a) + W h {a). 



Further, 



Wf(ax, ■ ■ -^a^-x, l,0|t+i, • • • ,a n ) 
= 2 f(-l)/i( a ) 



r-mTl — 1 



^/o(«)-^/i(«)- 
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Combining Relations (H|), ([2]) and ([3]), we have 

W h (a, b) = 2^- 2 ((-l)9oW + (-1)^)) (-l)To(a) 
+2 i i ± 21 „ 2 ^_ 1 )3o(6) _ (_!)5T(6)) (_!)7T(a) 

= 2 I ^ L - 1 (-1)^ 6 ). 
According to the above equality, it follows that 

(_l)M<t,b) = 1 ^(_l)9o(6) + (_i)gT(fe)^ (_l)7o(a) 
+ 1 ((-l)So(b) _ (_!)9T(6)) (_l)7T(a)_ 

Then we have 

fc(a, 6) = go(6) fo(a) © (50(6) £1(6)) (fo(a) © 77(a)) . 

That is, 

h{x, y) = gt(y) © fo(x) © (^(y) © gi{y)) (%(x) © ]7(x)) . 



Remark 1 Without loss of generality (up to linear equivalence) let us take 
H = p = n. Let us denote e = (0, . . . , 0, 1). For any x and y, we have (go © 
9i){v) = D e g(y,0) where "," denotes concatenation et D e g is the derivative 
off/, defined as D e g(y, 0) = g(y, 0) ©fif(y, 1). Then/t(x,y) = f(x, 0) © £/(y, 0) 
if D e g(y,0) = and %,y) = /(x, 1) ©#(y,0) if D e g(y,0) = 1. Hence, 
y) = /(x, 0) © y(y, 0) © D e /(x, 0)D e g(y, 0) = /(x, L> e y(y, 0)) © g(y, 0) = 
f(x, 0) © y(y, D e f(x, 0). The derivative plays a role in a construction from 
|15j (which has been generalized in [11]), but the present construction is 
clearly different since it builds (n + m — 2)-variable functions from n- variable 
and m- variable ones. 

Remark 2 Taking h(x,y) = f x (x) © g {y) © (/ © fi)(x) (g © yi)(y) or 
h(x,y) = f (x) © g x [y) © (/ © fi)(x) (g © 9l ){y) or h(x,y) = fx(x) © 
9i(y) © (/o © /i)( x ) (5o © 9i)(y) gives three other bent functions; of course 
these functions correspond to applying Construction [1] to functions affinely 
equivalent to / and g. 

In what follows, we analyze the properties of h(x, y). Before that, we first 
introduce a notation. The algebraic degree of variable Xi in /, denoted by 
deg(/, Xi), is the number of variables in the longest term of / that contains 

Xi . 
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Proposition 1 Let n (> 2) and m (> 2) be two even numbers. Let f(X) € 
B n ,g(Y) € B m and h(x,y) G B n+m _2 be defined as in Construction^ Then 
2 < deg(h) < 2±f=2 - 1. 

Proof. Clearly, 2 < deg(h) since /i is bent. If deg(/) = 2 and deg(g) = 2, 
then deg(h) = 2. 

According to the bentness of f(X) (resp. g(Y)), we have deg(/) < n/2 
(resp. deg(g) < m/2). Further, we have deg(/o © /i) < n/2 — 1 (resp. 
deg(go © ffi) < m/2 — 1) because deg(/(x) © f(x © a) < n/2 — 1, where 
a e FJj. Thus, from Construction [IJ we have deg(/i) < n+ ^~ 2 - 1, the 
equality holds if and only if deg(/, x^) = n/2 and deg(g,y p ) = m/2. 

Remark 3 If m = 2, theng(Y) = yiy2®Kyi->V'2)i where l(yi, y2) is an affine 
function. By Construction [fl we have deg(/o) < deg(/i) < deg(/) < (n + 
m — 2)/2. From Proposition [H the (n + m — 2)-variable functions constructed 
by Construction Q] have algebraic degree not exceeding (n + m — 2)/2 — 1 
if n > 2 and m > 2. Thus, they can not belong to the PS~ class, since 
all n- variable functions in PS~ have algebraic degree n/2 exactly |18j . In 
addition, the constructed function h has algebraic degree 2 if and only if 
both / and g have algebraic degree 2. 

n/2 

Let us apply Construction [T] to M-M functions f(x) = 4>i{ x n/2+i-> • • • > 

i=l 

m/2 

x n )xi®u(x n / 2+ i, ...,x n ) and g(y) = ipj(y m /2+i, • • • , y m )yi®v (y m / 2 +x, ■ • • , 

y m ), where w(x n / 2 +i, . . . ,x n ) is any Boolean function in n/2 variables and 
v{y m /2+i, ■ ■ ■ ,2/m) is any Boolean function in m/2 variables. We deduce the 
following primary construction: 

Corollary 2 Let n and m be two positive even numbers and \i € {1, . . . , n/2}, 
p€ {l,...,m/2}. For x = {x Xl . . . , a^_i, x M+ i, . . . , x n ) e^ _1 ,!/= (j/i,---, 
y P -i,y P +i,- ■ ■ ,Vm) € F™ -1 , tei ^(x n/2+1 ,...,x n ) = (0i, . . . ,(f> n / 2 ) be a 
Boolean permutation in n/2 variables and ip(y m /2+ii ■ ■ ■ 1 2/m) = (tpi, • • • j ^m/2) 
a Boolean permutation in m/2 variables. Then the (n + m — 2) -variable func- 
tion 

n/2 m/2 

h(x,y) = </>i(x n / 2+1 ,...,x n )xi® ipj(yx +m /2,----,ym)yj 

i^M J^P (4) 

© 0At( X n/2+l5 • • • ) x n)^p{yi+m/2i ■ ■ ■ > 2/m) 

(71 / 

is bent, where u(x n/2+ x, ■ ■ ■ , x n ) 6 B n/2 , t>(y m / 2+ i, • • • , y m ) G #m/2- 
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Remark 4 The bent functions given by Corollary [21 have a form similar to 
those of M-M functions; indeed, 4> fJ ,(x n / 2+1 , x n )ip p (y rn / 2+ i, ■ ■ ■ , y m ) does 
not depend on the "affine" variables. There are cases where h(x, y) is an 
(n + m — 2)-variable M-M bent function; for instance when <j) p = xi and 
(01, . . . , (f>(i-i, (f>n+i, 4>n/2) is a Boolean permutation in n/2 — 1 variables, or 
= Vt and (V'l; ■ • • > ^p-l> ^p+lj ^m/2) is a Boolean permutation in m/2 — 1 
variables. But the functions of Corollary [2] are in general not M-M functions; 
the mapping: 

© : (x n/2+ i, ■ ■ ■ ,x n ,y m / 2+ i, ■ ■ ■ ,y m ) >-> 

(01(^/2+1) • • • ) x n), • • • , 4>^-l( x n/2+li ■ ■ ■ i x n) ; 
</V+l( x n/2+lj • • • ) x n), ■ ■ ■ , <j>n/2 ( x n/2+l ) ■ ■ ■ > x n), 
$l(y m /2+l, • • • , Vm), • • • , 1pp-l(y m /2+l, • • • ) J/m), 
(j/m/2+1 , • • • , Z/m), • • • , (z/m/2+1 , • • • , J/m)) 

is not a permutation; it is even not a vectorial function with an equal number 
of input and output bits. 

In (8J Proposition 1] is introduced a generalization of the M-M construction: 
let s > r and let be any mapping from F| to W 2 such that, for every 
a G ¥ 2 , the set _1 (a) is an (n — 2r)-dimensional affine subspace of F| and 
let g be any Boolean function on F| whose restriction to -1 (a) is bent for 
every a G ¥ 2 , if n > 2r (no condition on g being imposed if n = 2r, which 
corresponds to the original M-M construction), then x ■ ®(y) © g(y) is bent. 
We can see that Corollary [2] is in some cases a particular case of this general 
construction of bent functions with s = (m + n) /2, r = (m + n — 4)/2 (this 
happens for instance when is an affine mapping). But, in general, it is 
not, since the condition "0 _1 (a) is an (n — 2r)-dimensional affine subspace 
of F|" is not satisfied. 

According to Remark[2]and Corollary^ we know that h(x, y)@4> l i{x n i 2 j r \, 
...,x n ), h(x, y) © ip p (y m /2+i, ■■■,y m ) and h(x, y) © 4> p (x n/2+1 , ...,x n ) © 
ipp(y m /2+i) •••) ym) ar e also bent functions, where h(x,y) are defined as 
Corollary [2j Further, similarly to Corollary [2j we are able to select fi £ 
{l,...,n/2}, pG {f + l,...,m} or M G {§ + l,...,n}, p G {l,...,m/2} 
or yu G + 1, . . . , n}, /) G + 1, . . . , m}. This gives three primary con- 
structions similar to that of Corollary (2) We can also apply Construction 
[TJ using as initial functions two elements of the PS ap class of bent func- 
tions (introduced in [18] and recalled for instance in |12j). Recall that the 
functions of this class are defined over F 2 „/ 2 x F 2 „/ 2 ~ ¥ 2 as f(x,y) = 
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g(x/y) where x,y G F 2 „/ 2 and g is balanced on F 2 n/2, with the conven- 
tion x/0 = 0. To define /o we need to restrict / to a linear hyperplane 
{{x, y) G F 2 „/ 2 xF 2n/2 [ Tr" /2 (ax©6y) = 0} of F 2 , where Tr™ /2 is the absolute 
trace over F 2ri / 2 and (a, 6) / (0,0). We have (/o © fi)(x,y) = D^ a ^f{x,y) 
for some (a, /3) G F 2 „/ 2 x F 2 „/ 2 such that tr(aa + 6/3) = 1. 

Corollary 3 Let n and m be two positive even numbers. We identify F 2 
(resp. F™/ 2 ) with the Galois field F 2 „/ 2 (resp. F 2m / 2 ). Let 6 (resp. -d) 
be a balanced function on F 2 „/ 2 (resp. F 2m / 2 ). Let (x,y) G F 2 „/ 2 x F 2 „/ 2; 
(z,t) G F 2m / 2 xF 2m / 2 , let f(x,y) = 6>(|) for y / 0, otherwise f(x,y) = 0, let 
g{z,r) = 0(f) /or r ^ 0, otherwise g(z,r) = 0. lei f {x,y) (resp. go(z,r)) 

be the restriction of f (resp. g) on {(x,y) G F 2 „/ 2 x F 2 „/ 2 \Tr^ 2 (ax © by) = 
0} (resp. {(z,t) G F 2 „ /2 x F 2m/2 |Tr™ /2 (cz © dr) = 0};, w/iere (a, 6) ^ 
(0,0) G F 2 „ /2 x F 2 „/ 2 , (c,d) ^ (0,0) G F 2m/2 x F 2m/2 . We take fi{x,y) = 
fo(x © a,y © /?), u>/iere Tr^ 2 (oa © 6/3) = l,(a,/3) G F 2n/2 x F 2 „/ 2 and 

gi(z,r) = go(z(Bu, rffiw), w/iere Tr\' 2 {cu®dv) = 1, (u,w) G F 2m / 2 x F 2m / 2 . 
Then 

h(x,y,z,r)= f {x,y) © g (z,r) © (/ © fi)(x,y) {go ©gi)(z,r) 
zs a 6en£ function on F 

Of course we could also apply Construction Q] using as initial functions 
an M-M function and a function of PS ap . 

In 1976, Rothaus presented a secondary construction which uses three 
initial n- variable bent functions f^\ f^ 2 \ f^ to build a fourth one / which 
is an (n + 2)-variable bent function: 

Rothaus' construction |36| : Let x = [x\, X2, ■ ■ ■ , x n ) G F 2 and x n+ i, x n+ 2 G 
F 2 . Let / (1) (x), f (2 \x), f i3) (x) be bent functions on F£ such that / (1) (x) © 
f^ 2 \x) © f^\x) is bent as well, then the function defined at every element 
(x,x n+1 ,x n+2 ) G F 2 +2 by: 

f(x,x n+l ,x n+2 ) = fW(x)fM(x)(BfW(x)fW(x) 

ef (2) {x)f (3) {x) f(2) {x)]Xn+1 

®[fW(x) © f( 3 \x)]x n+2 © X n+1 X n+2 

is a bent function in n + 2 variables. 

We apply Construction [1] to bent functions constructed by Rothaus' 
construction. 
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Corollary 4 Let n and m be two positive even numbers and x G ¥ 2 , y G F™, 
x n+ i, x n+ 2, Um+i, Um+2 £ ^2- Let an (n + 2) -variable bent function f and an 
(m + 2) -variable bent function g be built by means of Rothaus' construction, 
respectively from n-variable bent functions f^\ f^ 2 \ and m-variable bent 
functions , g^ , g^ . Then 

h(x, y, x n+1 , y m+1 ) =/(D (x)f& (x) © /« (x)f^ (x) 
®fW(x)fW(x)(BgW(v)gW(y) 
(Bg^(y)g^(y)®9 {2) (y)9 {3) (y) 
®[f ( - l \x)®f^(x)]x n+1 

(B[g^(y)®g^(y)]y m+ i (5) 

©[/W(x)e/( 3 )(x)]b( 1 )(y)e 5 ( 3 )( y )] 

©[/ (1) (z)©/ (3) (z)]?/m + l 

eb (1) (y)®5 (3) (y)]^n+i 

ffi^n+12/m+l- 

is a bent function in n + m + 2 variables. 

Proof. We select / and g as the initial functions of Construction [1] and set 
/i = ra + 2,p = m + 2. From Theorem [H we know that h(x, y, x n+ i,y m+ i) is 
a bent function in n + m + 2 variables. 

Next, we consider the bent functions in class D as the initial functions 
of Construction [TJ We first introduce class D, which has been derived in 
[3] from M-M bent functions, by adding to some functions of this class the 
indicators of some vector subspaces: 

n/2 

The class D of all the functions of the form <!>i(x n /2+i, ■ ■ ■ > x n )xi@\E 1 (xi, 

i=i 

. . . ,£ n /2)l-E 2 ( x n/2+ii • • • ,Xn), where 4> is anv permutation on F^ 2 , E\,Ez 
are two linear subspaces of F^ 2 such that ^(Ez) = and 1 e x {%\ ,■■■■> x n / 2 ) 
(resp. ^E 2 { x n/2+ii ■ ■ ■ -, x n) is the characteristic function of E\ (resp. E2). 

Corollary 5 Let n and m be two positive even numbers and \x G {1, . . . , n/2}, 
pe {1, . . . ,m/2}. For x = (x x , . . . , a^_i, z M+ i, . . . , x n ) G^" 1 ,?/ = (yi,..., 
y p -i,y p+ i,...,y m ) £ F™" 1 , let <p(x[ n/2 ^ ) = [4>i, ■ ■ ■ , &1/2) be a Boolean per- 
mutation in variables and ^(Y^ m ^) = {ipi, • • • , ipm/2) a Boolean permuta- 
tion in § variables, where x[ n/2) = (x n / 2+ i, ■ ■ ■ , x n ), Y} m/2) = {y m / 2 +i, ■■■,y m )- 
Let Ei, E 2 (resp. "Bi,^) be two linear subspaces o/F^ 2 (resp. F™^ 2 J such 
that <fi(E 2 ) = E^ (resp. ^(^2) = ^i)- Then the (n + m — 2) -variable 
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function 



is bent. 



n/2 m/2 

Hx,y) = © Mxt /2) )xi®® i>j(Y} m/2) )yj 

i=l 3=1 

n/2 

© © (r M © 1) II (*< © T * © l)ls 2 (^i /2) ) 

tG-Bi «=1 
m / 2 

© ©(^©i) U(yj®^®m 2 (Y} m/2) ) 

?eSi j=i 



(xJ n/2) )Vv(y x (m/2) ) 



n/2 

)^(y 1 (m/2) ) ( © n © r* © i) ) i E2 (4 n/2h 

rG-Ei »=l 
m/2 

©^i n/2 M © n^©^©i))i S2 (n (m/2) ) 

n/2 

© n(^©^ffii) ) i E2 (x{ n/2) " 

rG-Ei 1=1 
m/2 

x | © n(vi©*®i)i iH 2 (^ (m/2 '- 



n/2 

Proo/. Let / = ^(x{ n/2) ) a* l Bl (xi, . . . , x n/2 )l E2 (x[ n/2 >),g = 

m/2 

^•(y 1 (m/2) ) % l Sl (yi, • • • , ym/ 2 )lH 2 (^ (m/2) ). Clearly, is a bent 

3=1 

function in n + m — 2 variables if we select / and g as the initial functions 
of Construction [TJ 



4 Secondary constructions of highly nonlinear func- 
tions 

In this section, we present a generalization of the indirect sum construction 
for constructing resilient functions with high nonlinearity. Before that, we 
first recall the secondary construction of bent functions deduced by Carlet, 
Zhang and Hu in [16J. 
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Lemma 4 Let n and m be two even positive integers. Let fa(x),fa(x) and 
fa(x) be bent functions in n variables. Let g\ (y), 52(2/) o,nd g%(y) be bent 
functions in m variables. Denote by v\ the function fa ffi fa © ^3 and by 
vi the function <7i ffi (72 © <?3- If both v\ and v 2 are bent functions and if 
v\ = fi © h © h, ^en 

f(x,y) = fa(x) © gi (y) © (fa © fa)(x)( gi © g 2 ){y) © {fa © fa)(x)(g 2 © g 3 )(y) 
is a bent function in n + m variables. 

Now, we adapt the above construction for constructing resilient func- 
tions. 

Theorem 2 Let n, m, t and k be four integers such that —l<t<n and 
— 1 < k < m. Let fa(x),fa(x) and fa(x) be three t -resilient functions in n 
variables. Let g\ (y), 52(2/) an d g 3 (y) be k -resilient functions in m variables. 
If fi( x ) © h(x) © fz( x ) i s a ^ so a t-resilient function in n variables and 
9i(y) ©52(2/) ©53(2/) is also & n r -resilient function in m variables, then the 
function 

f(x, y)= h{x) © gi {y) © (fa © fa)(x)( gi © g 2 ) (y) © (fa © h)(x)(g2 © g 3 )(y) 
is a (t + k + 1) -resilient function in n + m variables. 

Proof. From Lemma [TJ f(x, y) is a (t + k + l)-resilient function in n + m 
variables if we can prove that Wf(a, f3) is null for every a G € such 
that < wt(a, 0) < t + k + 1. We have: 

W7(a,/9) 

zSF™ j/GF™ 

= £ (-l)"^ J] (_i)9i(y)©/3-s/ 

/lO)=/ 2 M=/3M= 

_|_ ^ (_iy®a-x Y (—i)9i(v)®P-V 

*eq, yew™ 

f 1 (x)=f 2 (x)=f 3 (x)=l - (6) 

+ (_]_)lffia-a: ^ (_l)S2(j/)®/3-i/ 

^£F™, j/GF™ 

/lO)#/ 2 0<0=/30)= 

-I- V (-I) ' 21 ^ (—1\92(V)®P-V 

xSF™, J/GF™ 
/lO)#/ 2 (:<0=/3<»=l 
_|_ (— l) a ' X ( — 1) S3 ^® /3 ' S/ 

zSF™, J/GF™ 
/ 2 OWlO<0=.f3<»= 
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+ 



E E (-1 



/3W? i /lW=/2W=l 



+^ 92 (/3) 



+^ 93 (/3) 



E (-i) c 



E 



flW=/j(<)=/3(«)=« /lM=/2M=/3M = 1 



E (-I)"" 



E (-i) c 



_/l 0-0^/20-0 = / 3 (*) = 1 /l 0-0^/2 0-0 = / 3 (*)=0 



e (-ir a 



E (-i) a ' a 



/2(a:Wl(*)=/3("0=° ftOO^/lOO^C*^ 1 



3i ©92*53 



(/?) 



E (-i) a - x - E (-1)°" 



/l(x)=/ 2 (^)=0 
/3(^) = 1 



/ 1 (x)=/ 2 (x)=l 
/ 3 0O=O 



= W- 91 (/3) 



( 



E ( -i)-(i±(zi)^)(i±(zi)^ ) 

e(GF£ 

-)- e {-ir* c- { -T ix) ) C- { ~T {x) ) 



i_(_i)/ 3 w . 

V 2 



+ ^ 92 (/?) 



E (-l)-(i±(rl)^) ( M^!l ) 



^ i- ( -i)ftt«) , 
/ l+(-l)ftM . 

V 2 



E (-i)a-»( i-(-^ w )( i+(-;) ftW ; 



+^ 3 (/3) 



E (_i)^( 1 +(- 1 / 1(3;) )( 1 -(- 1 2 ) /2( ' ) ) 

a;eF™ 

l+(-l)/3^) A ^ 1 ^. :c / l-(-l^' r y+(-l) / ' (,) ' 



- E 

xGF™ 



+W, 



3i©92©93 



(/?) 



, 1_(_1)/ 3 W 
v 2 



£ ( -Qa-z( l+(-l) /l( ' ) )( l+(~l) /2(:,,) - 



X&2 16 



)- e (-ir x ( 



M/ i-(-i) ft( 'y-(-i) ft(,) ) 



^ i + (_i)/ 3 w y 



Hence: 



W f (a,P) =\W gi {p)[W h { a ) + W f2 (a) +W h (a) + W mmh (a)] 
+\W g M [W fl (a) - W f2 (a) -W h (a) + W fl(Bmf3 (a)} 
+W 93 (P) [W h (a) - W f2 (a) +W h (a) - W fMh {a)\ 

©92© 93 

ifi) [W fl (a) + W f2 (a) -W h {a) - W h<sh9h {a)\ . 

(7) 

Since /i,/2, /3 and fx © fi © fz are t-resilient, we have Wf^a) = and 
^7i©/20/3( a ) = f° r an y a £ FJ? such that < wt(a) < t , where z = 1,2,3. 
Since g\,g2, 53 and g\ © g2 © 53 are fc-resilient, we have W 9i ((3) = and 
w 9i©92©93 W) = for an y P e¥f such that < wt(f3) < k, where i = 1, 2,3. 
In addition, we have wt{a) < t or wt(f3) < k if /3) < t + A; + 1. Further, 
according to Relation ©, /(x, y) is a (i + /c + l)-resilient function in n + m 
variables. 

Remark 5 The indirect sum is a particular case of this construction: it 
corresponds to the case /2 = fz and 52 = 53- 

We modify now the construction of Theorem [2] to ensure a high non- 
linearity of the constructed resilient function: to this aim, we assume that 
the functions fi are bent (of course, they can then not be balanced and the 
order t of Theorem [2] is then equal to —1). Before that, we first present a 
lemma. 

Lemma 5 Let n (> 6) be an even positive integer and m be a positive 
integer. Let fi(x),f2(x) and fz{x) be bent functions in n variables such that 
v \ = /i©/2©/3 is a bent function and v\ = /i©/2©/3- Let 52(4/) and 
g^{y) be functions in m variables. Denote by V2 the function g\ © 52 © <?3- 
Let f(x,y) be defined as in Theorem^ and a S F^,/? £ F™. Then, there are 
four cases. 

1. LfW fl (a) = W h {a) = W h {a), then W Vl (a) = W fl {a). Further, 

W f (a,P) = W gi (P)W fl (a); 

2. LfW h {a) = W h (a) + W h {a), then W Vl {a) = W h {a). Further, 

©92 ©93 

3. LfW fl (a) / W h (a) = W h (a), then W Ul {a) = W h {a). Further, 

W f (a,l3)=W g2 (/3)W fl (a); 
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4- IfW h {a) = W f3 (a) ^ W h {a), then W Vl {a) = W h {a). Further, 

W f (a,f3) = W g:j (f3)W fl (a). 

Proof. Since v\(x) is a bent function in n variables and v\ = fx © fi ffi fy, 
then 

(_l)/i©/2©/3 _ r_ 

that is, 

W fl (a)W h (a)W h (a) = 2 n W Vl (a). (8) 

We also know that Wf^a) = ±2"/ 2 for any a € where i = 1,2,3. 
Thus, combining Relations ([7]) and ([8]), the conclusion is held. 

Theorem 3 Let n (> 6) be an even positive integer. Let m and k be two 
integers such that k < m — 1. Let fi(x), f-z{x) and fs(x) be bent functions in 
n variables. Let gi(y), 52(2/) an d 53(2/) be k-resilient functions in m variables. 
Denote by v\ the function /1 © /2 © fj, and by V2 the function 5i © 5§ © 53- 
Lf v\ is a bent function, v<i is a k-resilient function and if v\ = f\ © fi © fs, 
then 

f{x,y) = fi(x)®gi(y) © (A © / 2 )(a;)(5i © 52) (y) 
©(/2©/3)(a;)(32©ff3)(y) 

is a k-resilient function in n + m variables. Further, we have 



(9) 



JV) > 2 n+m - 1 - 2 n / 2 - 1 x max j max{|W 9l (/3)|}, 
^{l^ 2 (/ 3 )l}'™{l^3(/3)|},max{|^ 2 (/3)|} 
and the equality holds if and only if {fx, fx ffi 1} Pi {/2, / 2 © 1} = fi © 

1} n {/ 3 , h ffi 1}) = ({/ 3 , / 2 ffi 1} n {/ 3 , / 3 © i}) = 0. 

Proof. According to Theorem [2l f(x,y) is a fc-resilient function in n + m 
variables. 

Next, we consider the nonlinearity of f(x, y). From Lemma[5j we imme- 
diately have 

Nf > 2"+— i - 2™/ 2 - 1 x maX {max{|W gi (/3)|} 5 
max{|Ty 92 (/3)|}, max{|W 53 (/3)|}, max{|W^C8)|}l , 
the equality holds if and only if all four cases of Lemma [5] can happen, that 

is, {f lt fx ffi 1} n {/ 2 , / 2 ffi 1} = ({fx, h ffi 1} n {/ 3 , h ffi i}) = ({/ 2 , / 2 ffi 1} n 
{/3,/sffii) = 0- 
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Remark 6 Theorem[3] allows constructing resilient functions offering a com- 
promize between resiliency order (whose ratio with the number of variables 
is lowered when we move from functions gi to /) and nonlinearity (which is 
enhanced thanks to the contribution of the bent functions, resulting in the 
coefficient 2 n / 2 ~ 1 in Relation Q). This is useful cryptographically speaking 
since low order resilient functions with high nonlinearity are more useful 
than high order resilient functions (with inevitably low nonlinearity accord- 
ing to the Sarkar-Maitra bound). If the nonlinearity of m- variable resilient 
functions 31, 32, 33 and g\ ©32 ©33 can exceed 2 m ~ 1 — 2L m / 2 J , then the nonlin- 
earity of f(x,y) constructed by Theorem [3] exceeds 2 n+m ~ 1 — 2L( n+m )/ 2 J . If 
m is even, k > m/2—2 and 31,32,33 and <7i©<72©<73 are m-variable fc-resilient 
functions achieving Sarkar et al's bound, then Nf = 2 n+m ~ 1 — 2 n / 2 ~ 1 + fc + 1 ; 
If m is even, k < m/2 — 2 and 31,32,33 and 31 © 32 © 33 are m-variable 
/c-resilient functions achieving Sarkar et al's bound (their nonlinearity equal 

2 m-l _ 2 m/2-l _ 2 fc+l) ; then Nf = 2 n+m-l _ 2 (n+m)/2-l _ ym/H+k+l ^ f urther) 

when n = 6, we can obtain a (m + 6)-variable /c-resilient function with non- 
linearity 2 6+m ~ 1 — 2( 6+m )/ 2_1 — 2 k+i . However, / does not achieve Sarkar 
et al.'s bound with equality, in general. 

Examples of application. In [11| [15] is given an example of functions 
fi , ji , /3 satisfying a condition which is the same as that needed in Theorem 
[3j Let •&{%) and 9(x) be n-variable bent functions. Assume that there 
exists a vector a such that D a -& = D a 6, where D a -&(x) = $(x) © $(x © a) 
is the so-called derivative of $ at a. We can take fi(x) = i!}(x), f%(x) = 
•&(x © a),fz(x) = 9(x), the hypothesis of Theorem [3] is satisfied: v%(x) = 
D a fi{x) © 9(x) = Da9(x)jB 9{x) = 9(x © a) is bent and we have u{(x) = 
9{x)®a-x = {f l ®f 2 ®h){x). 

For example, let x = (x', x") £ Fg, x', x" G F^ 2 . Let (f> be a permutation 
on F^ 2 and pi,P2 be two arbitrary n/2-variable Boolean functions. Let us 
define the M-M bent functions = x' ■ <f>(x") © pi(x"), 9(x) = x' ■ <f>(x") © 
P2(x"). Let a' be any nonzero element of F^ 2 and a = (a',0, ... ,0) £ F^. 
Thus, we have D a 9 = D a i}, that is, functions fi(x) = ~&(x),f2{x) = $(x © 
a), fs(x) = 9(x) satisfy the condition of Theorem [3j 

Remark 7 According to LemmaO we know that Wf(a, j3) = W 9l {f3)Wf 1 (a), 
or WgtfflWf^a), or W g MW fl (a), ° r WWe 93 (Wi(«)- Thus, from 
Theorem [3l an (n + r)th-order plateaued function in n + m variables can be 
obtained if 31, 32 , 33 and 31 © 32 © 33 are rth-order plateaued functions. 

Another consequence of Lemma [5] is the following secondary construction: 
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Proposition 2 Let n (> 6) be an even positive integer. Let m and k be two 
integers such that k < m — 1. Let fx(x), f 2 (x) and fs(x) be bent functions 
in n variables such that v\ = f\® f 2 ® H is also a bent function and V\ = 
fl ® /2 ® h- Let p(y) and q(y) be two k-resilient functions in m variables. 
IfW fl {0) = W h {0) = W f3 (0) or W fl (0) + W/ 2 (0) = W h (0), where = 
(0,0..., 0) G F%, then we set g x (y) = p(y), g 2 (y) = q(y) and g 3 (y) = 
q(y) © Vil 

IfW fl (0) = W h (0) ^ W f3 (0) or W fl (0) = W/ 3 (0) / W h (0), then we set 
9i(y) =p{y)®Vi, 92{y) = q{y)®yi andg 3 (y) = q(y), where i G {1,2, . . . ,m}. 
Then, f(x,y), defined as in Theorem^ is a k-resilient function in n + m 
variables with nonlinear ity: 



Nf > 2 n+™-i _ 2 n/2-i x maxj maxllH^^)!}, max{|^(/3)|}| , (10) 

the equality holds if and only if the equality fi = f 2 = fz does not hold. 

Proof. Since p(y) (resp. q(y)) is a £;-resilient m-variable function, the 
resiliency order of p(y) © y. L (resp. q(y) © yi) is at least k — 1, that is, 

W p(y)® yi W) = ( res P- W q{y)(Byi(P) = °) for an Y wt iP) <k-l. 

From Theorem [3l the function / is at least (k — l)-resilient. Now, we 
prove / is a A:-resilient function in n + m variables. 

When W fl (0) = W f M = W h (0) or W fl (0) + W h (0) = W h (0), we 
set gi(y) = p(y), g 2 {y) = q{y) and g 3 (y) = q(y) © y^ Thus, g x and g 2 are 
fe-resilient functions, g 3 (resp. g\ © g 2 ©53) is at least (k — l)-resilient. Let 
(a, /3) G F2 +m and wt(a, fi) = k. There are two different cases to consider. 

1. If wt(a) > 1, then wt(f3) < k—1. Moreover, we know that W gi< ^ g2 ^ g3 

= and Wgtip) = 0. Certainly, W gi (/3) = and W g2 (f3) = 0. From 
Relation W f {a,j3) = 0. 

2. If wt(a) = 0, i.e., a = 0, then wt(f3) = k. We know 51 and g 2 
are fe-resilient functions, i.e., W gi ((3) = and W g2 (/3) = 0. Accord- 
ing to Lemma El we know that Wf(a,f3) = W gi (f3)Wf 1 (a) (resp. 
W f (a,P) = W g MW fl (a)) if W h (a) = W h (a) = W h (a) (resp. 
W h {a) / Wf 2 (a) = Wf 3 (a)). Thus, we have that W f (a,f3) = 0. 

When W fl {0) = W f2 (0) ^ W f3 (0) or W fl {0) = W/ 3 (0) / W/ 2 (0), we 
set 31 (y) = p(y) © j/j, g 2 (y) = q{y) © y, and g 3 (y) = q(y). We can prove 
Wf(a,f3) = for wt{a,j3) = khy using the same method as above. 

Relation (|10p is then straightforward. From Lemma [5j the equality of 
Relation (fTUj) holds if and only if the equality f\ = f 2 = f 3 does not hold. 
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Remark 8 If N p = N q , then N f = 2 n+m ~ 1 - 2"/ 2 " 1 x max{\W p (P)\}. If 

we choose p(y),q(y) from PW functions ( Patterson and Wiedemann in [35] 
proposed 15-variable Boolean functions with nonlinearity 2 14 — 2 7 + 2 4 + 2 2 , 
which are called PW functions), then an (n + 15)-variable function with 
nonlinearity 2 n+15 ~ 1 - 2 n / 2 + ? - 1 + 2 n / 2 + 4 " 1 + 2 n / 2 + 2 " 1 can be obtained by 
Proposition [2j The nonlinearity of functions constructed by this way is 
the best known. In addition, if we apply direct sum (resp. indirect sum) 
using as initial functions p(y) and fi(x) (resp. p(y),q(y), fi(x) and fj(x)), 
where i,j = 1,2,3, i ^ j, then the nonlinearity of functions constructed 
this way equals 2 n+m ~ 1 - 2 n / 2 ~ 1 x max{|Wp(/3)|} as well. If we do not 

consider the resilience of the constructed function f(x,y), then we can set 
9l(y) =p{y),92(y) = q(y) and g 3 (y) = q(y) ®l(y), where l(y) £ A m . 

In [21], Fu et al. proposed a method for constructing A;-resilient functions 
in odd numbers of variables. For odd n > 35, k = 1 (resp. n > 39, k = 2), a 
large class of A;-resilient n-variable functions, whose nonlinearity is the best 
known, can be constructed by the method. From their construction [211 
Construction], we found that the direct sum functions were chosen initial 
functions. Here, if we substitute the functions constructed by Proposition [2] 
for the direct sum functions, then many resilient functions on odd number 
of variables whose nonlinearities equal those of the functions presented by 
Fu et al. in [21] can be obtained. 

Example 1 Several constructions of 8-variable 1-resilient functions with 
nonlinearity 116 were presented in \27[ \28[ \29$ . By using two different 
1-resilient 8-variable functions and three 6-variable bent functions /i,/2,/3 
(which satisfy fx ffi fa © being also bent and fx © fa © f 3 = fx®fa® 
fa), with Proposition^ we can obtain lA-variable 1-resilient functions with 
nonlinearity 2 13 - 2 6 - 2 5 = 8096. The functions (14, 1, -, 8096) earlier 
known could only be obtained by direct sum and indirect sum. 

Clearly, the functions constructed by Proposition [2] are different from 
those constructed by direct sum. In Table [H we describe the difference 
between the functions constructed by Proposition [2] and the functions con- 
structed by indirect sum. 

5 Conclusion 

Bent functions and resilient functions with high nonlinearity are actively 
studied for their numerous applications in cryptography, coding theory, and 
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Table 1: Forms of Functions Constructed by Indirect Sum and Proposition 

12, , , , 





Initial Functions 


Indirect sum 


Proposition [2] 




fl f2, h f3, 




h(x)®gi(y)® 




fi(x)®gi(y)® 




fl /3, 91 92, 


(fl 


© f2)(x)(gi © g 2 )(y) 


(fl 


© f2)(x)(gi © g 2 )(y) 




93 = 92 © y% 








®Vi(f2 ® fz)(x) 




fl / f2, f2 / h, 




h(x)®gi(y)® 




h(x)®gi(y)® 




fl = h,9i + 92, 


(fl 


© h)(x)(gi © g 2 )(y) 


(fl 


®f 2 )(x)(gi ®g 2 )(y) 




93 = 92 © y% 








®Vi(h ®h)(x) 



other fields. 

In this paper, we focused on the constructions of both bent functions and 
highly nonlinear Boolean functions. We first presented a novel secondary 
construction of bent functions. By using this method, we could deduce 
several concrete constructions of bent functions from known bent functions. 
In addition, we presented a generalization of the indirect sum construction 
for constructing resilient functions with high nonlinearity. 
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